The vulnerability exists in dracut's die() function, which writes error messages into shell scripts under the initramfs emergency-hook directory without proper shell quoting. When the error message includes data derived from the DHCP ROOT_PATH option, a rogue DHCP server on the adjacent network can inject command-substitution sequences. These sequences execute with root privileges the next time dracut sources its emergency hook scripts during boot-failure handling. Exploitation requires network boot using DHCP, an attacker-controlled DHCP server on the same network segment, and failure of the netroot handler resolution. This vulnerability is distinct from CVE-2026-6893 and affects systems relying on DHCP-supplied ROOT_PATH values. Red Hat has rated the impact as Important and provided a security update for Red Hat Enterprise Linux 9. Mitigation includes restricting DHCP server access on networks used for network boot until a fix is applied.

Successful exploitation allows an adjacent network attacker controlling a rogue DHCP server to execute arbitrary OS commands as root during system boot failure handling. This can lead to full system compromise, including unauthorized code execution, data modification, denial of service, and hiding of malicious activities. Systems not using network boot or DHCP-supplied ROOT_PATH are not impacted. The CVSS v3.1 base score is 7.5 (High), reflecting high confidentiality, integrity, and availability impacts with no required privileges or user interaction but high attack complexity.

Red Hat has released a security update addressing this vulnerability for Red Hat Enterprise Linux 9. Users should apply the available patches as described in the Red Hat advisory (RHSA-2026:54571). Until a fix is applied, restrict DHCP server access on networks used for network boot by implementing DHCP snooping or using dedicated/trusted provisioning VLANs to prevent rogue DHCP servers from influencing boot parameters. Systems not performing network boot or not relying on DHCP-supplied ROOT_PATH are not exposed to this issue.